{"id":"CVE-2020-14298","aliases":["EUVD-2020-6450","GHSA-vqjv-866h-qv94","RHSA-2020:2653"],"status":"published","title":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053...","description":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00321,"percentile":0.25403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-273"],"published":"2020-07-13T20:53:26Z","modified":"2026-10-24T10:30:39Z","affected":[{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-logrotate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-lvm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-novolume-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-rhel-push-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-v1.10-migrator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-162.git64e9980.el7_8"}]}],"bundled":3}],"products":[{"vendor":"[unknown]","product":"docker"},{"vendor":"docker","product":"docker"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2020-14298","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://access.redhat.com/security/vulnerabilities/runcescape","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-5736","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHBA-2020:0427","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14298","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2653","tags":["advisory"]},{"url":"https://access.redhat.com/security/vulnerabilities/runc-regression-docker-1.13.1-108","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848239","tags":["report"]},{"url":"https://github.com/advisories/GHSA-vqjv-866h-qv94"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848829","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2653.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8867","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/runc-regression-docker","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8867","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14298","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14300","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14300","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14300","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-14298","description":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.","status":"published","published":"2020-07-13T20:53:26Z","modified":"2024-08-04T12:39:36.209Z","updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6450","description":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.","status":"published","published":"2020-07-13T20:53:26Z","modified":"2024-08-04T12:39:36Z","updated_at":"2026-11-03T03:07:34.636169Z"}],"ghsa":[{"id":"GHSA-vqjv-866h-qv94","title":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053...","description":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.","status":"published","published":"2022-05-24T17:22:49Z","modified":"2023-02-10T05:06:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:54:02.847747Z"}],"nvd":[{"id":"CVE-2020-14298","description":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.","status":"published","published":"2020-07-13T21:15:14.187Z","modified":"2026-06-17T02:54:29.367Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-273"],"updated_at":"2026-11-02T14:06:09.126752Z"}],"osv":[{"id":"CVE-2020-14298","description":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.","status":"published","published":"2020-07-13T21:15:14.187Z","modified":"2026-10-24T10:30:39.938094045Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"RHSA-2020:2653","title":"Red Hat Security Advisory: docker security update","status":"published","published":"2024-09-13T22:05:34Z","modified":"2025-11-22T12:03:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"}]}}